I feel your pain, and with the dual provenance of the openwrt kernel (linux X.Y and usually a backport of mac80211) it gets harder. (But other world vendors have it much, much harder, with their frankenkernels) I don't know what guidelines are coming out of this effort (https://openssf.org/ ) is anyone in openwrt part of those processes?